CVE-2026-9636: Rockwell Automation Logix Controllers improper certificate revocation check

CVE-2026-9636 · Severity: info · CVSS 8.2 · Published 2026-07-14

Rockwell Automation industrial controllers and communication modules are affected by a security flaw in how they verify digital certificates. These devices are used to manage high-speed industrial processes and safety applications in manufacturing and infrastructure. An attacker could exploit this issue to establish unauthorized connections by using certificates that have been revoked, potentially bypassing security protections designed to ensure only trusted systems can communicate with the controllers.

Technologies: Rockwell Automation CompactLogix 5380, Rockwell Automation ControlLogix 5580, Rockwell Automation GuardLogix 5580. Vendors: Rockwell Automation.

Quick answers

Is CVE-2026-9636 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9636 being exploited in the wild.
How severe is CVE-2026-9636?
Informational severity, with a CVSS score of 8.2, published 14 July 2026.
Which products and versions are affected?
Rockwell Automation 1756-EN4TR V6.001, V7.001; Rockwell Automation Compact GuardLogix 5380 V36-V37; Rockwell Automation CompactLogix 5380 V36-V37; Rockwell Automation ControlLogix 5580 V36-V37; and 1 more.
Is there a fix for CVE-2026-9636?
A patch was published on 2026-07-14: Firmware versions V38.011 and V8.001 released to correct the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9636 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2026-9636?
Check whether you run Rockwell Automation 1756-EN4TR, Rockwell Automation Compact GuardLogix 5380, Rockwell Automation CompactLogix 5380 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A certificate revocation handling vulnerability (CWE-299) exists in several Rockwell Automation Logix controllers and EN4 communication modules. The flaw occurs when the device fails to properly validate the Certificate Revocation List (CRL) for intermediate certificates. A network-based attacker can exploit this by presenting a certificate signed by a revoked intermediate CA to establish a trusted CIP Security connection. This vulnerability specifically impacts environments where the CRL feature is enabled and intermediary certificates are in use. Fixed firmware versions have been released to address the validation logic.

Affected products

  • Rockwell Automation ControlLogix 5580 V36-V37
  • Rockwell Automation CompactLogix 5380 V36-V37
  • Rockwell Automation GuardLogix 5580 V36-V37
  • Rockwell Automation Compact GuardLogix 5380 V36-V37
  • Rockwell Automation 1756-EN4TR V6.001, V7.001

Timeline

  • 2026-07-14: advisory: Initial release of SD1788 by Rockwell Automation
  • 2026-07-14: patched: Firmware versions V38.011 and V8.001 released to correct the issue

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.